CVE-2016-2174 SQL injection vulnerability in the policy admin tool in Apache Ranger
HighCVSS 7.2
EPSS 1.9%
- Published
- Updated
- Exploit status
- No public exploit known
Description
SQL injection vulnerability in the policy admin tool in Apache Ranger before 0.5.3 allows remote authenticated administrators to execute arbitrary SQL commands via the eventTime parameter to service/plugins/policies/eventTime.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| org.apache.ranger/ranger(Maven) | < 0.5.3 | 0.5.3 |
| apache ranger | = 0.5.0 | No fix listed |
| apache ranger | = 0.5.1 | No fix listed |
| apache ranger | = 0.5.2 | No fix listed |
References
- nvd.nist.gov third-party-advisory vendor-advisory
- cwiki.apache.org
- github.com vendor-advisory
- [oss-security] 20160601 CVE update (CVE-2016-2174) - Fixed in Ranger 0.5.3 mailing-list